Skip to main content

Use of an insecure channel

Need​

Secure transmission of sensitive information

Context​

  • Usage of PHP for server-side web development
  • Usage of GuzzleHttp for making HTTP requests in PHP

Description​

Non compliant code​

public function sendData($data){
    $url = 'http://example.com/api/data';
    $client = new \\GuzzleHttp\\Client();
    $res = $client->request('POST', $url, ['form_params' => $data]);
    return $res;
}

The above code is a method in a Laravel controller that sends data to a remote server using the GuzzleHttp client. The data is sent via an HTTP POST request. The vulnerability here is that the data is sent over an insecure HTTP connection, which means it's not encrypted. This could potentially allow an attacker to intercept the data during transmission, leading to a data breach.

Steps​

  • Change the URL from HTTP to HTTPS. This will ensure that the data is sent over a secure, encrypted connection.
  • If the server supports it, enable HTTP Strict Transport Security (HSTS) to ensure that all future communications are over HTTPS.
  • Consider using a library or tool that supports automatic encryption of data.
  • Ensure that the server's SSL certificate is valid and up-to-date.
  • Consider using a VPN or other secure network connection if transmitting sensitive data.

Compliant code​

public function sendData($data){
    $url = 'https://example.com/api/data'; // Changed from http to https
    $client = new \\GuzzleHttp\\Client(['verify' => true]); // Enable SSL certificate verification
    $res = $client->request('POST', $url, ['form_params' => $data]);
    return $res;
}

The original code was sending data over an insecure HTTP connection. This is a major security vulnerability as it allows potential attackers to intercept the data being transmitted.

The fixed code now sends data over a secure HTTPS connection. HTTPS is HTTP with encryption. The only difference between the two protocols is that HTTPS uses TLS (SSL) to encrypt normal HTTP requests and responses. This keeps the data safe from eavesdroppers who could otherwise have access to the data if it were sent over an insecure HTTP connection.

The GuzzleHttp client is also configured to verify the SSL certificate of the server. This is an important step to ensure that the client is communicating with the intended server and not a malicious one.

Please note that the server should also be configured to redirect all HTTP requests to HTTPS to ensure that all data is transmitted securely. This can be achieved by enabling HTTP Strict Transport Security (HSTS) on the server.

For transmitting highly sensitive data, consider using additional security measures such as a VPN or other secure network connections.

References​

Last updated on